VYPR
Vypr IntelligenceAI-generatedOct 8, 2026· 25 CVEs

Brocade Fabric OS: 25 Vulnerabilities Including Command Injection and Auth Bypass Disclosed Together

Brocade Fabric OS faces a critical disclosure of 25 vulnerabilities, including command injection and authentication bypass, on October 8, 2026.

Key findings

  • 25 Brocade Fabric OS vulnerabilities disclosed on October 8, 2026, impacting multiple versions.
  • High-severity flaws include command injection, authentication bypass, and privilege escalation across various components.
  • Affected versions include those prior to 9.2.2d, 10.0.0a1, and 10.0.1.
  • Patches are available in Fabric OS versions 9.2.2d, 10.0.0a1, and 10.0.1, with 10.0.1 addressing all disclosed issues.
  • Urgent upgrades are recommended to prevent unauthorized access and command execution.

On October 8, 2026, a coordinated disclosure event revealed 25 vulnerabilities affecting Brocade Fabric OS, with all flaws impacting versions prior to 9.2.2d, 10.0.0a1, and 10.0.1. The batch of vulnerabilities, disclosed within a three-hour window, includes numerous high-severity flaws such as OS command injection, authentication bypass, and privilege escalation, posing a significant risk to the security of storage area networks (SANs).

Several vulnerabilities center around command injection, allowing attackers to execute arbitrary system commands. CVE-2026-94586 and CVE-2026-94581, both rated High, exploit flaws in the WebTools administrative interface and REST API respectively, enabling authenticated users to gain root-level command execution. Similarly, CVE-2026-87673, also High severity, involves OS command injection within maintenance utilities, while CVE-2026-87666 targets the time and zone management subsystem. CVE-2026-87662 highlights issues with unsanitized parameters during upgrade requests, leading to command execution.

Authentication bypass and privilege escalation are also prominent themes. CVE-2026-94585, a High severity vulnerability, allows an unauthenticated attacker to gain administrative access via an unpatched Single Sign-On (SSO) workflow on the MXG610 platform. CVE-2026-94577, another High severity flaw, permits authenticated users to bypass Role-Based Access Control (RBAC) within the CLI authorization mechanism. CVE-2026-87663 combines authentication bypass with command injection in the inter-switch remote execution service.

Other notable vulnerabilities include CVE-2026-87426, a Medium severity flaw that allows unauthenticated attackers to enumerate configuration details and network topology. CVE-2026-94584, a Low severity race condition in the web management daemon, could lead to incorrect client IP address processing during authentication. CVE-2026-87660, a High severity vulnerability in the diagnostic kernel module, allows unprivileged local users to disrupt hardware operations.

The affected versions are broadly those prior to 9.2.2d, 10.0.0 through 10.0.0a1, and in some cases, prior to 10.0.1. Brocade has released patches for these issues, with versions 9.2.2d, 10.0.0a1, and 10.0.1 addressing the disclosed vulnerabilities. Version 10.0.1 is noted to fix all disclosed issues.

Given the severity and number of vulnerabilities, including those allowing for remote command execution and authentication bypass, users of Brocade Fabric OS are strongly advised to update to the patched versions as soon as possible to mitigate the risk of unauthorized access and system compromise. The coordinated nature of this disclosure underscores the importance of timely patching for critical infrastructure components.

The batch of vulnerabilities includes:

This comprehensive set of vulnerabilities highlights critical security weaknesses across multiple components of Fabric OS, emphasizing the need for prompt attention from administrators. The disclosure on October 8, 2026, within a narrow timeframe, suggests a single coordinated research effort or discovery event.

The patched versions are 9.2.2d, 10.0.0a1, and 10.0.1. It is recommended to upgrade to the latest available version, 10.0.1, which addresses all disclosed issues. The urgency of these updates cannot be overstated, as the vulnerabilities permit severe impacts including full system compromise.

The broad range of vulnerabilities, from unauthenticated information disclosure to authenticated command execution and privilege escalation, presents a complex threat landscape for organizations relying on Brocade Fabric OS. Proactive patching and security monitoring are essential to defend against potential exploitation. The coordinated disclosure of these 25 CVEs on a single day indicates a significant security event for the Brocade ecosystem.

AI-written article. Grounded in 25 CVE records listed below.